diff --git a/lib/isc/netmgr/http.c b/lib/isc/netmgr/http.c
index 94f38485d8..8f6cf2104d 100644
--- a/lib/isc/netmgr/http.c
+++ b/lib/isc/netmgr/http.c
@@ -2097,8 +2097,15 @@ isc__nm_http_request(isc_nmhandle_t *handle, isc_region_t *region,
 	return ISC_R_SUCCESS;
 
 error:
+	/*
+	 * client_send() detaches and frees the stream on a submit failure
+	 * (it nullifies sock->h2->connect.cstream before submitting, then
+	 * frees it on the failure branch), so the reloaded pointer can be
+	 * NULL here.  The caller still gets the error result and reports the
+	 * failure itself.
+	 */
 	cstream = sock->h2->connect.cstream;
-	if (cstream->read_cb != NULL) {
+	if (cstream != NULL && cstream->read_cb != NULL) {
 		cstream->read_cb(handle, result, NULL, cstream->read_cbarg);
 	}
 	return result;